Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/06/2026, 04:36
General
- Target XBinderOutput.exe
- Size 713KB
- Sample260626-e8ed4sgy7s
- SHA256 72f7cd03b60b66ea7f2e5e91542c78fd33e990a673dcdfe3cc412e8295293c20
Score
10/10
Malware Config
Extracted
Family
-
xbinder
Mutex
-
Q1hKouDwgpDa4SCtu
Attributes
-
primary_drop_directory
%Temp%
-
primary_execute
true
-
primary_hidden_file
false
-
primary_resource_name
CREATIVE EAX.exe
-
secondary_drop_directory
%Temp%
-
secondary_execute
true
-
secondary_hidden_file
false
-
secondary_resource_name
MasonClient.exe
Signatures
- Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
- Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe"C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"36⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"38⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"39⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"40⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"41⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"42⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"44⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"45⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"46⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"47⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"48⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"49⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"50⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"51⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"52⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"53⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"54⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"55⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"56⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"57⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"58⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"59⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"60⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"61⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"63⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"64⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"65⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"67⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"68⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"69⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"69⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"68⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"67⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"66⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"65⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"64⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"63⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"62⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"61⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"60⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"59⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"58⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"57⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"56⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"55⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"54⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"53⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"52⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"51⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"50⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"49⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"48⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"47⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"46⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"45⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"44⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"43⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"42⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"41⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"40⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"39⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"38⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"37⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"36⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"35⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"34⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"33⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"32⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"31⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"30⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"29⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"28⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"27⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"26⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"25⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"24⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"23⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"22⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"21⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"20⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"19⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"18⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"17⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"16⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"15⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"14⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"13⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"12⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"11⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"10⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"9⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"8⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"6⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CREATIVE EAX.exe.log
CREATIVE EAX.exe
MasonClient.exe
memory/3268-25-0x0000000000870000-0x0000000000912000-memory.dmp
memory/3268-27-0x000000001C350000-0x000000001C360000-memory.dmp
memory/3796-0-0x0000000000FC0000-0x0000000001078000-memory.dmp
memory/3796-1-0x000000001C700000-0x000000001C710000-memory.dmp
memory/4984-26-0x0000000000240000-0x0000000000252000-memory.dmp